bufu163[.]com

This domain, bufu163.com, operates as a fraudulent Counter-Strike 2 (CS2) skin trading platform designed to deceive users into entering account credentials or transferring in-game items. Analysis of the site’s content reveals claims of being the "number one among all skin sites for CS2," a common tactic used by phishing operations to lure victims with false legitimacy. The site likely harvests login details for Steam or other gaming accounts, enabling unauthorized access, item theft, or financial fraud. No legitimate skin trading service would require users to input sensitive credentials on an untrusted platform, particularly one with a recent creation date and no verifiable reputation. Infrastructure analysis confirms the domain’s malicious intent. bufu163.com was registered on March 22, 2025, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. VirusTotal detections show 13 out of 95 security vendors flagging the domain as malicious, with classifications including phishing and fraud. The site resolved to IP address 188.114.96.3, hosted on Cloudflare’s network (AS13335), a common obfuscation technique used to mask the true origin of phishing infrastructure. Additionally, the domain appears on one security blocklist and was proactively taken offline, further indicating its illegitimate nature. If you visited bufu163.com or entered any credentials, immediate action is required. First, change passwords for Steam, CS2, or any other gaming accounts accessed on the site, using a unique, strong password for each. Enable multi-factor authentication (MFA) if not already active. Review account activity for unauthorized transactions, item transfers, or login attempts from unfamiliar locations or devices. If in-game items or currency were lost, report the incident to the platform’s support team with details of the interaction. Monitor linked financial accounts for suspicious activity, as stolen credentials may be used for broader fraud. Avoid clicking on links from unsolicited messages or social media posts promoting skin trading sites, and verify domain legitimacy through official sources before engaging.